Merge pull request #3818 from ysok-opendatahub-io/flip-centos-ubi-httpd #1422
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: Code static analysis | |
| on: # yamllint disable-line rule:truthy | |
| push: | |
| branches: [main, stable, 'rhoai-*'] | |
| pull_request: | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| permissions: | |
| contents: read | |
| jobs: | |
| check-generated-code: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup uv and Python | |
| uses: ./.github/actions/setup-uv | |
| - name: Rerun all code generators we have | |
| run: bash ci/generate_code.sh | |
| - name: Check there aren't any modified files present | |
| run: | | |
| clean=$(git status --porcelain) | |
| if [[ -z "$clean" ]]; then | |
| echo "Empty git status --porcelain: $clean" | |
| else | |
| echo "::error::Please run 'bash ci/generate_code.sh' (the command from the previous step), commit the changed files locally, and push again." | |
| echo "Uncommitted file changes detected: $clean" | |
| git diff | |
| exit 1 | |
| fi | |
| pytest-tests: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| # Full history so tests/test_pylock_downgrade.py can `git show origin/main:…/pylock.toml`. | |
| fetch-depth: 0 | |
| - name: Setup uv and Python | |
| uses: ./.github/actions/setup-uv | |
| - name: Check uv is installed correctly | |
| run: uv version | |
| - name: Install deps | |
| id: install-deps | |
| run: uv sync --locked | |
| - name: Static tests (pytest + Dockerfile alignment) | |
| run: make test | |
| if: ${{ steps.install-deps.conclusion == 'success' && !cancelled() }} | |
| env: | |
| # PR: compare to the PR base (fork PRs vs upstream main, not the fork default branch). | |
| # Push: compare to the previous tip of this branch (not origin/main on stable/rhoai-*). | |
| NOTEBOOKS_DOWNGRADE_BASE_REF: ${{ github.event.pull_request.base.sha || github.event.before }} | |
| - name: Upload Python coverage to Codecov | |
| if: ${{ !cancelled() && steps.install-deps.conclusion == 'success' }} | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| slug: opendatahub-io/notebooks | |
| files: coverage.xml | |
| flags: python | |
| fail_ci_if_error: false | |
| - name: Upload test results to Codecov | |
| if: ${{ !cancelled() && steps.install-deps.conclusion == 'success' }} | |
| uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1.2.1 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| go-tests: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Set up Go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version-file: scripts/buildinputs/go.mod | |
| - name: golangci-lint | |
| uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0 | |
| with: | |
| version: v2.12.2 | |
| working-directory: scripts/buildinputs | |
| - name: Install gotestsum | |
| run: go install gotest.tools/gotestsum@v1.13.0 | |
| - name: Run Go tests with coverage and JUnit output | |
| run: gotestsum --junitfile=junit-go.xml -- -coverprofile=coverage-go.out -covermode=atomic ./... | |
| working-directory: scripts/buildinputs | |
| - name: Upload Go coverage to Codecov | |
| if: ${{ !cancelled() }} | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| slug: opendatahub-io/notebooks | |
| files: scripts/buildinputs/coverage-go.out | |
| flags: go | |
| fail_ci_if_error: false | |
| - name: Upload Go test results to Codecov | |
| if: ${{ !cancelled() }} | |
| uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1.2.1 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| files: scripts/buildinputs/junit-go.xml | |
| code-static-analysis: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Do not check secrets, they are encrypted | |
| run: rm -rf ./ci/secrets | |
| - name: Install linting tools | |
| uses: ./.github/actions/apt-install | |
| with: | |
| packages: yamllint yajl-tools wget | |
| - name: Validate YAML files (best code practices check included) | |
| if: ${{ !cancelled() }} | |
| id: validate-yaml-files | |
| run: | | |
| # We ignore .tekton (managed by devops), insta-merge.yaml, and machine-generated .lock.yaml lockfiles | |
| # (e.g. rpms.lock.yaml, artifacts.lock.yaml — produced by rpm-lockfile-prototype with non-configurable indentation). | |
| find . -name "*.yaml" | grep -v "./.tekton/" | grep -v "./.github/workflows/insta-merge.yaml" | grep -v "\.lock\.yaml$" | xargs yamllint --strict --config-file ./ci/yamllint-config.yaml | |
| find . -name "*.yml" | grep -v "./.tekton/" | xargs yamllint --strict --config-file ./ci/yamllint-config.yaml | |
| # In some YAML files we use JSON strings, let's check these | |
| - name: Validate JSON strings in YAML files (just syntax) | |
| if: ${{ !cancelled() }} | |
| id: validate-json-strings-in-yaml-files | |
| run: | | |
| bash ./ci/check-json.sh | |
| - name: Validate JSON files (just syntax) | |
| if: ${{ !cancelled() }} | |
| id: validate-json-files | |
| run: ./ci/validate_json.py | |
| - name: Validate Dockerfiles | |
| if: ${{ !cancelled() }} | |
| id: validate-dockerfiles | |
| run: | | |
| wget --output-document=hadolint https://github.com/hadolint/hadolint/releases/download/v2.12.0/hadolint-Linux-x86_64 | |
| chmod a+x hadolint | |
| echo "Starting Hadolint" | |
| find . -name "Dockerfile*" | xargs ./hadolint --config ./ci/hadolint-config.yaml | |
| echo "Hadolint done" | |
| # This simply checks that the manifests and respective kustomization.yaml finishes without an error. | |
| - name: Check kustomize manifest | |
| if: ${{ !cancelled() }} | |
| id: kustomize-manifests | |
| run: ./ci/kustomize.sh | |
| # https://github.com/pre-commit/action | |
| prek: | |
| name: "prek" | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: ./.github/actions/setup-uv | |
| - name: "Cache prek" | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 | |
| with: | |
| path: ~/.cache/prek | |
| key: prek-${{ hashFiles('.pre-commit-config.yaml') }} | |
| # https://github.com/astral-sh/ruff/blob/3bfdb1208392802d3b38ec771789a99437c482d0/.github/workflows/ci.yaml#L810 | |
| - name: "Run prek" | |
| run: | | |
| echo '```console' > "$GITHUB_STEP_SUMMARY" | |
| # Enable color output for prek and remove it for the summary | |
| # Use --hook-stage=manual to enable slower hooks that are skipped by default | |
| uvx prek run --all-files --show-diff-on-failure --color always --hook-stage manual | \ | |
| tee >(sed -E 's/\x1B\[([0-9]{1,2}(;[0-9]{1,2})*)?[mGK]//g' >> "$GITHUB_STEP_SUMMARY") >&1 | |
| exit_code="${PIPESTATUS[0]}" | |
| echo '```' >> "$GITHUB_STEP_SUMMARY" | |
| exit "$exit_code" | |
| action-pin-check: | |
| name: GitHub Actions SHA pinning | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| env: | |
| PINACT_VERSION: "3.9.0" | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Install pinact | |
| run: | | |
| curl -sL "https://github.com/suzuki-shunsuke/pinact/releases/download/v${PINACT_VERSION}/pinact_linux_amd64.tar.gz" \ | |
| | tar xz -C /usr/local/bin | |
| - name: Check all actions are SHA-pinned | |
| run: pinact run --check | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Verify SHAs match version comments | |
| # aquasecurity org has an IP allowlist that blocks GHA runners | |
| run: pinact run --verify --exclude '^aquasecurity/trivy-action$' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |